[SECURITY] Identifiers may refer to resources outside the storage

The Driver needs to canonicalize all incoming identifiers at first,
and than check for their validity on every action performed.
If a canonicalized path resided inside a storage it does not contain
any ../ anymore.
An exception is thrown in that case.

Change-Id: I1154561760000f29afc83e6a8f302a6e7b55f3c3
Releases: 6.2, 6.1, 6.0
Fixes: #50883
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23599
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader
[SECURITY] Prohibit accessing storage 0 from backend UI

Manually accessing backend entry-points regarding files passing
an identifier with storage 0 may allow unfiltered access for read,
write, rename, create and delete actions.

The user interface must never deal with storage 0. Therefore
implement checks for storage 0 as protection.

Change-Id: Id64c29536d48dd0261993404d174815f18953afc
Releases: 6.2, 6.1, 6.0
Fixes: #50886
Security-Commit: b813a875ad76aa7860b76602eb1f32dcfc9fadcd
Security-Bulletin: TYPO3-CORE-SA-2013-003
Reviewed-on: https://review.typo3.org/23600
Reviewed-by: Oliver Hader
Tested-by: Oliver Hader